War Story: Migrating 1000+ IaC Modules from Terraform 1.10 to Pulumi 3.130 with Checkov 3.0

// pulumi-migrate.ts: Automated Terraform 1.10 to Pulumi 3.130 module converter
// Requires: @pulumi/terraform-bridge 3.130.0, @pulumi/aws 6.45.0, ts-node 10.9.0
import * as pulumi from \"@pulumi/pulumi\";
import * as aws from \"@pulumi/aws\";
import * as fs from \"fs/promises\";
import * as path from \"path\";
import { TerraformBridge } from \"@pulumi/terraform-bridge\";

// Configuration for migration batch
const config = new pulumi.Config(\"migration\");
const tfModulePath = config.require(\"tfModulePath\"); // Path to Terraform 1.10 module
const outputPulumiDir = config.require(\"outputDir\"); // Output directory for Pulumi code
const awsRegion = config.require(\"awsRegion\"); // Target AWS region

// Error handling wrapper for file system operations
async function safeReadDir(dirPath: string): Promise {
    try {
        return await fs.readdir(dirPath);
    } catch (err) {
        throw new Error(`Failed to read directory ${dirPath}: ${(err as Error).message}`);
    }
}

// Validate Terraform module has required files
async function validateTFModule(modulePath: string): Promise {
    const requiredFiles = [\"main.tf\", \"variables.tf\", \"outputs.tf\"];
    const files = await safeReadDir(modulePath);
    const missingFiles = requiredFiles.filter(f => !files.includes(f));
    if (missingFiles.length > 0) {
        console.error(`Invalid TF module: missing ${missingFiles.join(\", \")}`);
        return false;
    }
    // Check Terraform version constraint
    const versionFile = path.join(modulePath, \"versions.tf\");
    try {
        const versionContent = await fs.readFile(versionFile, \"utf-8\");
        if (!versionContent.includes(\"~> 1.10\")) {
            console.warn(`TF module may not be 1.10 compliant: no ~> 1.10 version constraint`);
        }
    } catch {
        console.warn(`No versions.tf found in ${modulePath}, assuming 1.10 compatibility`);
    }
    return true;
}

// Main migration function
async function migrateModule() {
    // Step 1: Validate input module
    if (!await validateTFModule(tfModulePath)) {
        pulumi.log.error(\"TF module validation failed, aborting migration\");
        process.exit(1);
    }

    // Step 2: Initialize Terraform Bridge for conversion
    const bridge = new TerraformBridge({
        terraformVersion: \"1.10.0\",
        provider: \"aws\",
        region: awsRegion,
    });

    // Step 3: Convert TF module to Pulumi program
    try {
        const conversionResult = await bridge.convertModule({
            sourcePath: tfModulePath,
            targetPath: outputPulumiDir,
            language: \"typescript\",
            generateTests: true, // Generate Checkov-compatible test stubs
        });

        if (conversionResult.warnings.length > 0) {
            conversionResult.warnings.forEach(w => pulumi.log.warn(`Conversion warning: ${w}`));
        }

        // Step 4: Inject Checkov 3.0 policy annotations
        const pulumiFiles = await safeReadDir(outputPulumiDir);
        const tsFiles = pulumiFiles.filter(f => f.endsWith(\".ts\"));
        for (const file of tsFiles) {
            const filePath = path.join(outputPulumiDir, file);
            let content = await fs.readFile(filePath, \"utf-8\");
            // Add Checkov skip annotations for known false positives
            content = content.replace(
                /(resource \"aws_s3_bucket\" \".*\")/g,
                '$1\n// checkov:skip=CKV_AWS_20: \"Bucket is public for marketing assets per policy\"'
            );
            await fs.writeFile(filePath, content, \"utf-8\");
        }

        pulumi.log.info(`Successfully migrated module to ${outputPulumiDir}`);
    } catch (err) {
        pulumi.log.error(`Migration failed: ${(err as Error).message}`);
        throw err;
    }
}

// Run migration with top-level error handling
migrateModule().catch(err => {
    console.error(\"Unhandled migration error:\", err);
    process.exit(1);
});

// pulumi-deploy.ts: Pulumi 3.130 deployment with Checkov 3.0 pre-deployment scans
// Requires: @pulumi/pulumi 3.130.0, checkov 3.0.0, @pulumi/aws 6.45.0
import * as pulumi from \"@pulumi/pulumi\";
import * as aws from \"@pulumi/aws\";
import { execSync } from \"child_process\";
import * as fs from \"fs/promises\";
import * as path from \"path\";

// Configuration
const config = new pulumi.Config();
const stackName = pulumi.getStack();
const checkovPolicyDir = config.require(\"checkovPolicyDir\"); // Custom Checkov policies
const awsRegion = config.require(\"awsRegion\");

// Interface for Checkov scan results
interface CheckovResult {
    passed: number;
    failed: number;
    skipped: number;
    results: Array<{
        check_id: string;
        check_name: string;
        resource: string;
        status: string;
    }>;
}

// Run Checkov 3.0 scan on Pulumi preview output
async function runCheckovScan(previewJsonPath: string): Promise {
    try {
        const scanOutput = execSync(
            `checkov -f ${previewJsonPath} --policy-path ${checkovPolicyDir} --output json --soft-fail`,
            { encoding: \"utf-8\", maxBuffer: 10 * 1024 * 1024 }
        );
        return JSON.parse(scanOutput) as CheckovResult;
    } catch (err) {
        // Checkov returns non-zero exit code for failures, so we parse stdout even on error
        const output = (err as any).stdout;
        if (!output) throw new Error(`Checkov scan failed: ${(err as Error).message}`);
        return JSON.parse(output) as CheckovResult;
    }
}

// Generate Pulumi preview JSON for Checkov scanning
async function generatePreviewJson(): Promise {
    const previewJsonPath = path.join(\"/tmp\", `pulumi-preview-${stackName}.json`);
    try {
        execSync(
            `pulumi preview --stack ${stackName} --json > ${previewJsonPath}`,
            { encoding: \"utf-8\", stdio: \"inherit\" }
        );
        return previewJsonPath;
    } catch (err) {
        throw new Error(`Pulumi preview failed: ${(err as Error).message}`);
    }
}

// Main deployment function
async function deployWithCheckov() {
    pulumi.log.info(`Starting deployment for stack ${stackName}`);

    // Step 1: Generate Pulumi preview
    const previewJsonPath = await generatePreviewJson();
    pulumi.log.info(`Generated preview JSON at ${previewJsonPath}`);

    // Step 2: Run Checkov scan
    const scanResults = await runCheckovScan(previewJsonPath);
    pulumi.log.info(`Checkov scan complete: ${scanResults.passed} passed, ${scanResults.failed} failed, ${scanResults.skipped} skipped`);

    // Step 3: Block deployment if critical failures exist
    const criticalFailures = scanResults.results.filter(
        r => r.status === \"FAILED\" && r.check_id.startsWith(\"CKV_AWS_\") // Only block on AWS critical checks
    );
    if (criticalFailures.length > 0) {
        const failureDetails = criticalFailures.map(f => `${f.check_id}: ${f.check_name} (${f.resource})`).join(\"\\n\");
        pulumi.log.error(`Blocking deployment due to ${criticalFailures.length} critical Checkov failures:\\n${failureDetails}`);
        throw new Error(\"Checkov policy violations detected\");
    }

    // Step 4: Proceed with Pulumi up
    try {
        execSync(`pulumi up --stack ${stackName} --yes --skip-preview`, { stdio: \"inherit\" });
        pulumi.log.info(\"Deployment completed successfully\");
    } catch (err) {
        pulumi.log.error(`Deployment failed: ${(err as Error).message}`);
        throw err;
    } finally {
        // Cleanup preview JSON
        await fs.unlink(previewJsonPath).catch(() => {});
    }
}

// Run deployment with error handling
deployWithCheckov().catch(err => {
    console.error(\"Deployment failed:\", err);
    process.exit(1);
});

// vpc-component.ts: Pulumi 3.130 reusable VPC component replacing Terraform 1.10 aws-vpc module
// Requires: @pulumi/aws 6.45.0, @pulumi/pulumi 3.130.0
import * as pulumi from \"@pulumi/pulumi\";
import * as aws from \"@pulumi/aws\";

// VPC configuration arguments
export interface VpcArgs {
    cidrBlock: string;
    region: string;
    availabilityZones: string[];
    enableNatGateway: boolean;
    tags?: pulumi.Input<{ [key: string]: pulumi.Input }>;
}

// Reusable VPC component resource
export class Vpc extends pulumi.ComponentResource {
    public readonly vpcId: pulumi.Output;
    public readonly publicSubnetIds: pulumi.Output;
    public readonly privateSubnetIds: pulumi.Output;
    public readonly natGatewayIds: pulumi.Output;

    constructor(name: string, args: VpcArgs, opts?: pulumi.ComponentResourceOptions) {
        super(\"custom:aws:Vpc\", name, {}, opts);

        // Validate input arguments
        if (args.availabilityZones.length < 2) {
            throw new Error(`Vpc ${name} requires at least 2 availability zones, got ${args.availabilityZones.length}`);
        }
        if (!args.cidrBlock.match(/^(\\d{1,3}\\.){3}\\d{1,3}\\/\\d{1,2}$/)) {
            throw new Error(`Vpc ${name} invalid CIDR block: ${args.cidrBlock}`);
        }

        // Create VPC
        const vpc = new aws.ec2.Vpc(`${name}-vpc`, {
            cidrBlock: args.cidrBlock,
            enableDnsSupport: true,
            enableDnsHostnames: true,
            tags: {
                ...args.tags,
                Name: `${name}-vpc`,
                ManagedBy: \"Pulumi\",
                Version: \"3.130\",
            },
        }, { parent: this });

        this.vpcId = vpc.id;

        // Create public subnets (one per AZ)
        const publicSubnets: aws.ec2.Subnet[] = [];
        const publicRouteTables: aws.ec2.RouteTable[] = [];
        for (let i = 0; i < args.availabilityZones.length; i++) {
            const az = args.availabilityZones[i];
            // Calculate subnet CIDR (split VPC CIDR into /24 blocks for public subnets)
            const subnetCidr = args.cidrBlock.replace(/\\/\\d+$/, `/24`).replace(/\\.\\d+$/, `.${i * 2 + 1}`);
            const publicSubnet = new aws.ec2.Subnet(`${name}-public-${i}`, {
                vpcId: vpc.id,
                cidrBlock: subnetCidr,
                availabilityZone: az,
                mapPublicIpOnLaunch: true,
                tags: {
                    ...args.tags,
                    Name: `${name}-public-${az}`,
                    SubnetType: \"Public\",
                },
            }, { parent: this });
            publicSubnets.push(publicSubnet);

            // Create route table for public subnet
            const publicRouteTable = new aws.ec2.RouteTable(`${name}-public-rt-${i}`, {
                vpcId: vpc.id,
                routes: [{ gatewayId: internetGateway.id }],
                tags: { Name: `${name}-public-rt-${az}` },
            }, { parent: this });
            publicRouteTables.push(publicRouteTable);

            // Associate route table with subnet
            new aws.ec2.RouteTableAssociation(`${name}-public-rta-${i}`, {
                subnetId: publicSubnet.id,
                routeTableId: publicRouteTable.id,
            }, { parent: this });
        }

        // Create internet gateway
        const internetGateway = new aws.ec2.InternetGateway(`${name}-igw`, {
            vpcId: vpc.id,
            tags: { Name: `${name}-igw` },
        }, { parent: this });

        // Create private subnets and NAT gateways if enabled
        const privateSubnets: aws.ec2.Subnet[] = [];
        const natGateways: aws.ec2.NatGateway[] = [];
        if (args.enableNatGateway) {
            for (let i = 0; i < args.availabilityZones.length; i++) {
                const az = args.availabilityZones[i];
                // Allocate Elastic IP for NAT gateway
                const eip = new aws.ec2.Eip(`${name}-nat-eip-${i}`, {
                    domain: \"vpc\",
                    tags: { Name: `${name}-nat-eip-${az}` },
                }, { parent: this });

                // Create NAT gateway in public subnet
                const natGateway = new aws.ec2.NatGateway(`${name}-nat-${i}`, {
                    allocationId: eip.id,
                    subnetId: publicSubnets[i].id,
                    tags: { Name: `${name}-nat-${az}` },
                }, { parent: this });
                natGateways.push(natGateway);

                // Create private subnet
                const privateSubnetCidr = args.cidrBlock.replace(/\\/\\d+$/, `/24`).replace(/\\.\\d+$/, `.${i * 2 + 2}`);
                const privateSubnet = new aws.ec2.Subnet(`${name}-private-${i}`, {
                    vpcId: vpc.id,
                    cidrBlock: privateSubnetCidr,
                    availabilityZone: az,
                    tags: {
                        ...args.tags,
                        Name: `${name}-private-${az}`,
                        SubnetType: \"Private\",
                    },
                }, { parent: this });
                privateSubnets.push(privateSubnet);

                // Create route table for private subnet pointing to NAT gateway
                const privateRouteTable = new aws.ec2.RouteTable(`${name}-private-rt-${i}`, {
                    vpcId: vpc.id,
                    routes: [{ natGatewayId: natGateway.id }],
                    tags: { Name: `${name}-private-rt-${az}` },
                }, { parent: this });

                // Associate route table with private subnet
                new aws.ec2.RouteTableAssociation(`${name}-private-rta-${i}`, {
                    subnetId: privateSubnet.id,
                    routeTableId: privateRouteTable.id,
                }, { parent: this });
            }
        }

        // Assign outputs
        this.publicSubnetIds = pulumi.output(publicSubnets.map(s => s.id));
        this.privateSubnetIds = pulumi.output(privateSubnets.map(s => s.id));
        this.natGatewayIds = pulumi.output(natGateways.map(ng => ng.id));

        // Register outputs with Pulumi
        this.registerOutputs({
            vpcId: this.vpcId,
            publicSubnetIds: this.publicSubnetIds,
            privateSubnetIds: this.privateSubnetIds,
            natGatewayIds: this.natGatewayIds,
        });
    }
}

import { TerraformModule } from \"@pulumi/terraform-bridge\";
const legacyVpc = new TerraformModule(\"legacy-vpc\", {
    source: \"./tf-modules/aws-vpc\",
    variables: { cidrBlock: \"10.0.0.0/16\" },
    terraformVersion: \"1.10.0\",
});

- name: Run Checkov Scan
  run: |
    checkov -f pulumi-preview.json --policy-path ./checkov-policies --output json > scan-results.json
    if [ $(jq '.failed' scan-results.json) -gt 0 ]; then exit 1; fi

import { Vpc } from \"./vpc-component\";
const mainVpc = new Vpc(\"main-vpc\", {
    cidrBlock: \"10.0.0.0/16\",
    region: \"us-east-1\",
    availabilityZones: [\"us-east-1a\", \"us-east-1b\"],
    enableNatGateway: true,
    tags: { Environment: \"production\" },
});